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FIGURE 2,0 

Social Network Analysis Link Charting Provides Important Insights into the Patterns of Data 



SOCIAL NETWORK ANALYSIS METRICS 

Once Lawfully intercepted communications have been 
displayed in a social network, Intellego provides a 
number of analytical toots to assist the user in deter- 
mining how important certain individuals or groups 
might be to the structure of the network. Intellego 
provides the ability to calculate measures of central- 
ity in the network, which provide a score for each node 
on the basts of its importance from both a targeting 
perspective and a monitoring perspective. 

The betweenness metric measures how often a node 
Lies on the shortest path between two other nodes. 
This measures how often an individual serves as a 
conduit of information throughout the network. In- 
dividuals with high betweenness scores are Likely to 
have vaLuabLe information about the network and are 
prime targets for monitoring. 



The closeness metric measures how close an indi- 
vidual node is to the center of the network by calcu- 
lating who can reach the entire network in the short- 
est number of connections. The individuals with high 
closeness scores are key from a targeting perspective 
as removing them from the network is Likely to break 
the network into isolated groups, thus preventing 
the network from communicating and operating as 
designed. An individual with a high cLoseness score is 
more Likely to be a decision maker, or an operational 
Leader of the network, as they are the cohesive piece 
that hoLds the network together. 
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Social Network Analysis 

AIDS LAWFUL INTERCEPT CASES 




Social Network Analysis (SNA) is a technique for modeling the com- 
munication patterns between individuals in a way that illuminates 
the structure of the network and the importance of individuals within 
the network, By visualizing the intercepted communications between 
individuals and websites as a social network, clear patterns can be 
uncovered immediately. 



SOCIAL NETWORK ANALYSIS OVERVIEW 

Social Network Analysis (SNA) is a technique for 
modeling the communication patterns between 
individuals in a way that iLluminates the structure of 
the network and the importance of individuals within 
the network. 

By visualizing the intercepted communications be- 
tween individuals and websites as a social network, 
clear patterns can be uncovered immediately from 
within the Intellego application. 

The SNA module is accessed in Intellego from the 
Analysis tab. Running an analysis on a case with mul- 
tiple intercepts provides critical information about the 
key players in the network that wouLd not otherwise 
be apparent browsing through the events themselves. 



SOCIAL NETWORK ANALYSIS IN LI CASES 

SNA extracts relationships from intercepted com- 
munications and displays relationships between key 
players in an intuitive and interactive way. Investi- 
gators are typicaLly buried in volumes of data— SNA 
helps them put a structure around this data turning 
it into useful information. 

One of the biggest challenges for investigators work- 
ing on lawful intercept cases is the difficulty in find- 
ing reLevant, pertinent information among the large 
volume of irrelevant data. As the volume of Internet 
communications grows exponentially, investigators 
need new tools to both understand the patterns and 
relationships in the intercepted communications and 
to driLl down and isoLate individual communications 
relevant to the case. Intellego's analysis modules 
help investigators do exactly that by displaying inter- 
cepted communications in an intuitive and interactive 
graphical diagram. 
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SOCIAL NETWORK ANALYSIS 



Intellego's SNA module also calculates Eigenvec- 
tor values for each node in the network, which gives 
high scores to nodes with strong connections to other 
nodes with high scores, 



Individuals with high eigenvector scores are key be- 
cause they are very highly linked to other important 
nodes within the network. Those individuals are likely 
to be key decision makers in the network due to their 
tight connections to other nodes placed highly in the 
network. 
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FIGURE 3.0 



SteNa "The Dog" 



Clyde Smith 

b 

Amanda Pratt 



James Franks and John Rattan have high betweenness scores— 
they are important conduits of information between the two groups 



FIGURE 4,0 

Note that although Tom has a Larger number of direct connections. 
Mery is connected to other people who themselves have many 
connections. Therefore Mary is likely more highly placed in the 
network than Tom. 
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Using the Social Network Analysis module, investiga- 
tors can quickly identify the key players in an orga- 
nization and then focus their investigations on those 
individuals. SNA aids investigators in uncovering and 
defining hidden relationships that can provide oppor- 
tunities to broaden the scope of the investigation and 
identify patterns that may help uncover communica- 
tions that are not currently being intercepted. 

INTELLEGO’S SOCIAL NETWORK ANALYSIS 
MODULE 

InteLlego automates the process of generating the 
sociaL network analysis and graph. Each individual, 
website, e-mail address or target is represented as 
a Node. Each communication event that connects 
two nodes is represented as an Edge. Once the inter- 
cepted data is modeled in this format, the Location of 
the nodes on the SNA diagram can be edited— either 
via automated Layouts or manual dragging and drop- 
ping— to present a clear picture of the patterns of 
communication throughout the network. This allows 
the investigator to cut through the clutter and im- 
mediately visualize the relationships between the 
various targets. 

InteLlego provides severaL automated layouts to help 
present the diagram in the clearest way possible and 
to assist in deducing communication relationship 
information. The hierarchical Layout establishes 
a hierarchy in the communications based on who 
communicates with whom. Based on how often 
people communicate, InteLlego can determine who 
lies where in the hierarchy. This may provide key 
intelligence on where to focus the investigation. The 
circular layout will visually differentiate groups of 
nodes that communicate mostly internaLLy and expose 
the outliers. This may indicate sub-groups that work 
semi-independently within a larger organization, for 
example a financing group and an operations group. 
Additionally, InteLlego provides filters that alLow an 

www.SS8.com I 750 Tasman Drive Milpitas CA 95035 USA 



investigator to focus only on a specific subset of the 
data, for example only suspect websites, to visualize 
just those elements. The symmetric Layout visually 
depicts those nodes that are the most highly con- 
nected at the center of the diagram while placing 
nodes with only one or two connections (leaf nodes) 
at the edges of the diagram. This allows the user to 
immediately notice the important nodes in a diagram. 




FIGURE 1.0 

Complex Social Network Diagram in Symmetric Layout 

From within the SociaL Network diagram, InteLlego 
works seamlessly with Intellego's reconstruction 
module, which reconstructs Internet sessions and 
visualizes the target's Internet activity. This a 1 Lows 
4 the user to drill down to the individual events that 
comprise a node or edge, and reconstruct those 
eventsdndividualLy to follow the exact same path 
as the target. By clicking on the edge, a list of com- 
munication events appears in the right hand portion 
of the screen. Clicking any individual bvent opens up 
a new window arid displays the visual reconstruction 
of the communication. 
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ISLAND ANALYSIS 

Xntellego also provides investigators with the ability 
to perform Island Analysis. This allows the user to 
identify and locate isolated islands of communication 
that have no connection to the rest of the diagram. 
These “islands ' 1 of communications may highLight 
areas of the diagram that are not pertinent to the in- 
vestigation. or possibly additional areas where further 
data is needed. 

The Social Network Analysis module allows users to 
locate islands based on either the number of nodes 
in the isLand or the number of communication events. 
For example, criminals often exhibit a separate pat- 
tern of communication often use separate identities 
when conducting illicit business as opposed to normaL 
Internet communications. The island analysis will 
help identify the ring of criminals associated with 
the illicit communications and help filter out the ir- 
relevant material. Additional, criminal enterprises 
will often use disposable cell phones for their criminal 
Internet activity and only communicate with each 
other on those phones. The island analysis will quickly 
identify those isolated groups with no outside activity. 



IMPROVED EFFICIENCY AND PRODUCTIVITY 

When combined with Intellego's reconstruction 
module, Intellego’s SociaL Network AnaLysis module 
significantly increases the productivity of investiga- 
tors by eliminating the need to sift through mountains 
of irrelevant intercepted data and allowing them to 
focus on only the materials that are important to the 
case. Social Network AnaLysis helps the investigator 
identify the key pLayers in a complex case - which 
often isn't the initial target of the monitoring - and 
with the use of the automated layouts, identify a hi- 
erarchy of individuals in the case aLl from the pattern 
of intercepted communications. Using these tools, 
IntelLego allows investigators to expand the inves- 
tigation to Locate and apprehend people higher up in 
the criminal organization. 
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